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1. 


Report  Organization 


1 . 1  Document  Goals 

The  purpose  of  this  document  is  to  provide  an  overview  of  the  important  safety  information 
and  operating  procedures  for  the  facility.  A  companion  document  is  the  original  Belcan 
"Preliminary  Safety  Report"  which  contains  much  more  specific  safety  information.  After  a  brief 
introduction,  specific  safety  concerns  are  discussed  based  on  the  PI&D  diagrams.  Thus  if  one 
wants  specific  information  about  a  tank  or  valve,  one  needs  only  to  note  which  PI&D  drawing  it  is 
on  and  go  to  that  section  of  the  safety  report.  This  overview  tries  to  avoid  repeating  the 
information  presented  in  the  Belcan  report,  and  it  does  not  discuss  the  data  acquisition  system 
(DAS)  or  the  instrumentation.  Neither  of  these  systems  represent  a  significant  safety  threat  and 
thus  a  full  description  of  them  would  complicate  this  document  beyond  the  point  of  usefulness. 

This  document  does  not  discuss,  in  detail,  the  construction  and  operation  of  the  key  components: 
the  main  valve,  the  isolation  valve  and  the  eddy  brake.  Sufficient  information  on  these  systems  is 
presented  to  provide  a  basis  for  discussing  the  safety  implications,  but  it  is  assumed  that  the  reader 
will  use  other  reports  for  the  detailed  mechanical  information  about  these  systems.  Nor  does  this 
document  discuss  standard  technical  practices  of  how  to  isolate  electrical  problems,  test  for  vacuum 
or  pressure  integrity,  etc.  It  is  written  so  that  a  person  with  standard  mechanical/electrical  skills 
can  comprehend  the  basic  operation  of  the  facility  (but  not  necessarily  how  to  operate  it)  and  the 
various  situations  that  can  arise  which  could  lead  to  safety  problems. 

The  document  is  divided  into  several  sections.  This  section  describes  the  goals  of  the 
report  and  how  to  update  procedures.  The  second  section  focuses  on  general  procedures  and 
problems.  In  addition  to  reviewing  the  operation  of  the  facility,  general  hazards  are  grouped  and 
discussed  by  how  fast  the  hazards  can  be  generated.  These  problems  lead  to  specific  conditions 
which  have  set  procedures  about  isolating  and  rectifying  the  problem.  These  are  discussed  in 
section  III.  To  aid  in  these  discussions,  and  to  make  the  manual  complete  without  having  to  refer 
to  other  manuals,  section  IV  has  several  different  diagrams.  The  first  are  the  as  supplied  PI&D 
diagrams  from  Belcan  Corp  (there  are  large  ones  in  the  "Preliminaiy  Safety  Report".  These  consist 
of  5  pages  and  contain  a  great  deal  of  information  about  the  overall  operation  of  the  system.  A 
second,  simplified  schematic  of  just  the  nitrogen  and  vacuum  systems  is  also  supplied.  In 
addition,  the  PI&D  diagrams  (Calspan)  for  the  main  valve  actuation  system,  its  operation 
sequence,  and  a  simplified  electrical  plan  are  also  supplied.  The  final  section  contains  checklists 
which  can  aid  the  test  engineer  in  setting  up  an  overall  test-operation  checklist.  These  are  grouped 
by  subsystems  since  they  may  be  used  in  different  ways  for  different  tests.  It  will  always  be  the 
responsibility  of  the  operating  person  to  assure  that  his  checklist  represents  the  real  test 
configuration. 


Note:  The  ATARR  is  a  research  facility  and  is  not  a  turn-key  facility.  Its 
conRgurations  and  needs  will  change  on  a  regular  basis.  Checklists  are  not 
insurance  policies  against  having  problems.  The  system  is  designed  to  prevent  a 
person  from  accidentally  creating  a  condition  which  could  be  dangerous  to  oneself 
or  the  facility,  but  it  will  not  prevent  one  from  making  serious  blunders  which 
expose  instrumentation  to  damage  or  prevent  the  facility  from  running  smoothly. 
That  can  only  be  accomplished  by  having  an  understanding  of  the  detailed 
operations  of  the  facility  components,  which  are  described  in  other  manuals. 

Thus  creating  these  checklists  should  be  a  verification  of  ones  understanding  of 
the  facility  and  its  operation,  not  a  substitute  for  it. 

1.2  How  To  Use/Update  This  Document 

It  should  be  clear  by  now  that  this  document  is  meant  to  be  concise  and  deal  only  with 
safety  issues.  Keeping  this  document  up  to  date,  reflecting  additions  to  the  facility  or  changes  in 
operation  is  critical.  At  the  back  of  the  document  there  is  a  soft  copy  of  the  text,  written  on  an 
Apple  Macintosh  based  system  with  Microsoft  word.  Most  any  word  processor  should  be  able  to 
access  this  information.  As  new  systems  come  on-line  their  PI&D  diagrams  should  be  added.  In 
addition,  general  checklists  should  also  be  added.  But  for  this  document  to  be  effective  it  should 
be  kept  relatively  short  and  free  from  information  specific  to  any  one  turbine  test. 

1.3  General  Definitions  Used  in  Report 

Throughout  this  report  the  words  "facility",  "system",  "component",  and  "laboratory  floor" 
are  used  often.  However,  there  may  be  times  when  the  items  or  places  that  these  words  refer  to 
may  not  be  clear.  To  avoid  problems  before  they  start  we  have  decided  to  specify  exactly  what  we 
mean  when  these  words  are  used  (most  of  the  time). 

Facility-  Refers  either  to  the  entire  test  stand  (i.e.  supply  tanks,  test  section,  dump  tanks, 
nitrogen  supply,  vacuum  system,  etc),  or  the  entire  complex,  including  the  vault  area  and  control 
room  (the  differences  should  be  apparent  from  usage) 

System-  The  facility  is  composed  of  several  systems  such  as  the  main  valve,  isolation 
valve,  instrumentation,  DAS,  MCS,  etc. 

Component  (or  Subsystem)-  Some  of  the  systems  have  specific  components.  An 
example  is  the  main  valve  which  has  a  piston  gas  supply  component  and  an  actuator  control 
component.  In  general  components  get  named  or  created  when  problems  start  to  occur  and  they 
get  traced  to  one  part  of  the  system. 

Laboratory  Area  (or  Bay  area)-  This  refers  specifically  to  the  part  of  the  building 
where  the  ATARR  sits.  It  does  not  include  the  vault  area  or  the  control  rooms. 
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2.  General  Facility  Description,  Procedures  and  Problems 

ATARR  safety  issues  can  best  be  described  by  examining  the  basic  construction  of  the 
facility  and  discussing  the  fundamental  operation  of  the  main  systems  and  their  individual 
components.  This  information  naturally  leads  to  the  general  problems  which  can  arise  from  the 
operation  of  the  facility.  Procedures  for  dealing  with  specific  hazards  are  dealt  with  in  section  HI. 

2.1  General  Facility  Safety  Systems 

The  laboratory  and  control  area  (Bid  7  IB,  J-Bay)  is  equipped  with  several  emergency 
exists.  Two  exist  on  either  side  of  the  bay  doors,  there  is  one  off  the  control  room,  there  is  the 
main  door  and  there  is  a  tunnel  which  connects  the  hah  outside  of  J-bay  with  the  contractor  area 
two  bays  down.  In  addition,  the  laboratory  area  has  low  oxygen  sensors.  If  at  any  time  these 
sensors  measure  low  oxygen,  the  large  doors  (at  either  end  of  the  laboratory)  immediately  rise  and 
the  fire  alarm  activates,  notifying  the  base  fire  department  personnel  who  are  the  only  ones  allowed 
to  shut-off  the  alarm.  There  are  also  several  fire  alarm  pull  stations  located  around  the  building  and 
there  is  at  least  one  movable  flammable  liquids  cabinet.  All  hazardous  material  used  in  J-Bay  are 
coded  and  are  listed  in  the  main  control  sheet  attached  to  the  doors  separating  the  laboratory  from 
the  main  hall. 

2.2  General  Gas  Flow  and  Valve  Operation  in  ATARR 

In  general,  the  ATARR  facility  consists  of  three  tanks  (1  supply  and  2  dump)  and  a  test 
section  which  is  isolated  from  the  tanks  by  two  large,  specially  built  valves  (the  main  valve  and  the 
isolation  valve,  see  figure  I). 


There  are  provisions  for  other  components  such  as  a  cooling  system  but  since  they  are  not  yet 
operational,  they  are  not  shown.  The  facility  is  operated  by  pressurizing  the  supply  tank  (and/or 
heating  it)  and  evacuating  the  test  section  and  dump  tank  so  that  the  turbine  can  be  spun  up  to  speed 
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using  an  electric  motor.  The  main  valve  is  opened  and  the  turbine  extracts  work  from  the  flow  as 
the  test  gas  passes  through  the  stage.  To  prevent  the  turbine  speed  from  increasing  during  the  test, 
an  eddy  brake  extracts  the  power,  thereby  maintaining  a  relatively  constant  turbine  speed.  The 
power  extracted  by  the  eddy  brake  goes  into  heating  the  eddy-brake  dmm.  The  test  time  is 
generally  limited  by  the  maximum  temperature  at  which  the  drum  can  maintain  safe  structural 
integrity.  Under  normal  working  conditions  only  about  a  third  of  the  gas  in  the  supply  tank  is 
used,  since  the  eddy  brake  limits  the  test  time.  The  isolation  valve  serves  three  main  purposes. 
First,  it  allows  the  test  section  to  be  isolated  from  the  dump  tank  creating  the  ability  to  both 
pressurize  and  evacuate  the  test-section  independently  of  the  supply  and  dump  tanks.  Secondly  the 
isolation  valve  sets  the  choke  area  downstream  of  the  stage,  creating  the  correct  pressure  drop 
across  the  stage.  Thirdly,  the  isolation  valve  acts  as  an  emergency  system  shut-down.  There  is 
enough  energy  in  the  supply  tank  at  its  normal  working  conditions  to  overspeed  many  turbines  and 
quickly  cause  them  to  burst  which  could  occur  if: 

1)  the  main  valve  failed  to  close,  causing  the  brake  drum  to  overheat  and  fail 

2)  the  eddy  brake  failed  during  turbine  operation 

3)  the  eddy  brake  was  configured  wrong  or  failed  to  engage 

Since  all  these  conditions  create  a  rapid  increase  in  the  turbine  speed,  the  isolation  valve  is  designed 
to  close  quickly  (less  then  100  ms)  if  the  speed  of  the  turbine  exceeds  some  preset  level. 

Facility  operation  requires  a  source  of  test  gas  and  a  source  of  vacuum.  A  mixture  of 
nitrogen  (N2)  and  carbon  dioxide  (CO2)  allows  a  wide  range  of  test  conditions  (again  see  figure  1). 
The  nitrogen  for  the  facility  (with  the  exception  of  the  activation  gas  for  the  main  valve,  discussed 
latter)  comes  from  a  tube  truck  located  outside  of  the  facility.  A  flexible  hose  connects  the  tube 
truck  to  a  permanent  pipe  which  has  a  pressure  regulator  preset  to  150  psi  (see  section  IV  for 
PI&D’s).  Thus  nitrogen  comings  from  this  source  into  the  building  can  not  have  a  pressure  greater 
than  150  psi  (without  something  failing).  The  nitrogen  entering  the  building  has  two  uses.  The 
first  is  to  power  the  valves  (instmment  reservoir);  the  other  is  to  fill  the  supply  tank  for  use  as  the 
test  gas.  The  carbon  dioxide  (CO2)  is  only  used  as  a  component  of  the  test  gas.  It  is  stored  as  a 
liquid  in  dewers  along  the  wall.  From  there  the  vapor  is  extracted  and  used  in  the  facility. 

The  vacuum  system  consists  of  a  Stokes  pump,  a  Roots  blower,  and  a  Balston  filter.  This 
system  is  plumbed  into  the  facility  to  provide  the  ability  to  evacuate  different  parts  of  the  facility 
either  independently,  or  together.  In  addition,  all  the  tanks  can  be  vented  to  atmosphere.  Each 
tank  or  section  of  the  facility  is  controlled  by  the  Monitor  Control  System  (MCS). 

Most  of  the  valves  in  ATARR  are  controlled  as  shown  in  figure  2  (notable  exceptions  are 
the  main  valve  actuator  control  component  of  the  main  valve  system  and  the  isolation  valve, 
discussed  latter).  The  instrument  N2  goes  to  an  actuator  valve  (usually  an  Asco  valve)  on  top  of 
the  main  process  valve.  This  gas  is  applied  to  the  actuator  by  use  of  a  small  electric  solenoid  valve 
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which  is  an  on/off-vent  type.  When  the  valve  is  activated,  pressure  is  applied  to  the  actuator  and 
the  process  valve  opens;  when  the  Asco  valve  is  deactivated  (or  off)  the  pressure  is  vented  and  a 
spring  return  forces  the  main  valve  closed. 

_ Figure  2  General  Valve  Control _ 


2.2.1  The  Monitor  Control  System  (MCS) 

The  MCS  has  three  main  tasks.  First,  it  controls  the  process  valves  in  two  different 
modes.  One  is  a  direct  command  from  the  user  to  open  or  close  a  specific  valve  (Exercise  Valve 
Menu,  see  MCS  manuals  Vol  1, 2,  and  3).  In  that  case,  the  MCS  tells  the  Asco  valve  to  activate 
which  in  turn  activates  the  main  process  valve.  Since  both  the  main  control  valve  and  the  Asco 
valves  have  separate  numbers  (usually  an  FVxyy  and  an  EVxyy,  respectively,  where  x  stands  for 
the  PID  sheet  and  yy  is  the  valve  number),  the  MCS  indicates  which  valve  it  is  controlling  by  the 
EVxyy  number.  Thus  it  is  important  to  know  which  electric  valve  controls  which  process  valve. 
The  second  type  of  process  control  comes  from  where  the  user  asks  the  MCS  to  do  a  specific  task, 
such  as  fill  the  supply  tank  to  a  set  pressure  (these  are  the  Charge,  Vent  and  Pumpdown  Menus). 
In  this  case,  the  MCS  goes  through  pre-programmed  logic  to  make  sure  that  certain  valves  are  set 
appropriately  before  the  action  is  allowed  to  take  place.  If  specific  conditions  exist,  the  MCS  will 
give  a  warning  and  not  proceed.  A  good  example  is  the  evacuating  procedure.  When  one  wishes 
to  evacuate  the  supply  tank,  the  MCS  checks  to  make  sure  the  pressures  in  the  lines  are  not  so  high 
as  to  damage  the  vacuum  pump.  If  they  are,  the  MCS  will  not  continue  until  the  supply  tank  is 
vented.  This  decision  process  is  referred  to  as  the  control  logic  and  is  specified  in  the  MCS 
manuals. 

The  second  task  of  the  MCS  is  monitoring  and  displaying  pressures,  alarm  conditions,  etc. 
Key  to  controlling  the  facility  is  knowing  what  pressures  are  in  each  section  of  the  facility. 
Pressures  can  be  monitored  and  displayed  on  the  MCS  as  well  as  used  for  inputs  to  logic  controls. 
When  a  pressure  goes  below  or  above  a  preset  value,  an  alarm  can  be  designated  to  appear  on  the 
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MCS.  This  has  been  used  extensively  to  keep  the  user  informed  as  to  supply  pressure,  cooling 
water  pressure,  etc. 

The  final  task  of  the  MCS  is  to  control  the  processes  of  arming  and  activating  the  main 
valve  and  eddy  brake.  Arming  each  system  is  similar  to  the  other  MCS  functions  in  that  the  MCS 
follows  a  distinct  logic  pattern  to  open  and  close  appropriate  valves  in  a  set  sequence.  The 
fundamental  difference  comes  when  the  MCS  controls  the  timing  of  when  to  start  the  eddy  brake 
and  when  to  close  the  main  valve.  In  this  process  all  other  functions  of  the  MCS  are  suspended  to 
maintain  a  quick  response  to  any  problems  encountered  during  a  run. 

2.3  General  Safety  Issues 

The  brief  description  of  the  facility  outlined  above  shows  how  problems  could  occur. 
Failure  of  power  to  the  Asco  valve,  or  low  instrument  nitrogen  pressure  could  cause  the  main 
process  valves  to  close  unexpectedly.  This  has  lead  to  one  on  the  major  design  philosophies  of  the 
ATARR  system  which  is  Fail-Isolate.  If  anything  fails  in  the  ATARR  system,  or  if  an 
emergency  exists,  the  entire  system  is  designed  to  close  all  valves,  which  isolates  all  sections  of  the 
facility. 

There  are  really  three  different  types  of  problems  that  can  arise  in  the  facility  which  have 
fundamentally  different  time  constants.  The  first  set  of  problems  involves  the  evacuation  or  filling 
of  the  various  tanks  and  sections  in  the  ATARR  facility  and  have  the  longest  time  constants  since 
these  process  usually  take  tens  of  minutes  to  complete.  These  are  all  governed  by  the  process 
controls  outlined  above  and  failure  generally  consists  of  the  facility  not  filling  when  it  is  supposed 
to,  or  not  evacuating  when  it  should.  This,  while  annoying,  is  not  a  safety  issue,  since  the  tanks 
all  have  emergency  reliefs  on  them  (thus  they  can  not  be  over-pressurized  and  the  reliefs  are  ducted 
to  the  outside),  and  the  flow  from  the  high  pressure  tanks  outside  is  metered  down  to  150  psi  with 
the  flow  restricted.  In  addition  there  are  many  manual  ways  (i.e.  independent  of  the  MCS)  to 
check  pressure  levels.  Failure  can  also  come  from  a  loss  of  communications  from  the  MCS  to  the 
valve  or  from  the  MCS  reading  an  inaccurate  pressure.  In  the  first  case,  the  controllers  of  the 
valves  can  be  set  so  that  in  the  event  of  lost  communications  they  either  return  to  the  last  state  of  the 
valve,  or  they  default  to  a  preset  position  (either  open  or  close).  For  this  facility,  all  valves  have 
been  set  to  fail  close,  thus  from  any  failure  (short  of  a  mechanical  valve  failure)  they  close.  The 
last  potential  problem  is  for  the  MCS  to  read  a  pressure  inaccurately.  This  occurs  when  the 
pressure  transducers  drift.  This  is  only  a  problem  when  the  facility  has  to  be  vented.  The  pressure 
transducers  are  absolute  sensors  and  have  been  found  to  be  accurate  to  about  ±2  psi.  Thus  one  can 
vent  the  facility  using  the  vent  command  (which  opens  the  vent  valves  until  the  pressure  reads  1 
atmosphere  and  then  closes  the  vent  valves)  and  still  have  some  pressure  (or  vacuum)  in  the  tank. 
This  problem  is  easily  overcome  by  manually  opening  the  vent  lines  before  servicing  the  facility. 
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The  second  set  of  problems  (with  a  time  constant  of  seconds)  comes  from  arming  the 
systems  which  allow  the  ATARR  facility  to  operate.  These  would  be  the  main  valve,  the  isolation 
valve,  and  the  cooling  system  (when  it  is  installed).  These  are  problems  only  if  the  valves  have  a 
pressure  differential  across  them  and  something  were  to  go  wrong  during  the  arming  sequence 
which  would  cause  an  unexpected  valve  motion.  How  critical  a  situation  like  this  may  be  is  a 
strong  function  of  the  facility  configuration.  Without  the  rotor  installed,  there  is  little  that  can 
happen  if  the  main  valve  were  to  open  unexpectedly.  These  situations  are  avoided  by  not  allowing 
a  pressure  differential  to  exist  in  the  system  until  one  is  ready  to  operate  the  facility.  Examining  the 
three  main  systems:  the  main  valve,  the  isolation  valve,  and  the  eddy  brake  can  help  to  illustrate 
these  points. 

2.3.1  Main  Valve 

The  run-time  operation  of  the  main  valve  is  covered  in  a  separate  document  (see  Main  Valve 
Report  for  more  details),  but  it  can  be  summarized  here  for  clarity.  The  complete  main  valve 
system  consists  of  a  piston  supply  component,  an  actuator  control  component  (which  controls  the 
piston  supply)  and  a  triggering  component.  Figure  3  shows  a  simplified  schematic  of  the  piston 
gas  supply  and  figure  4  shows  the  actuator  control  component.  The  main  valve  is  moved  using  a 
hydraulic  piston  .  The  main  valve  is  held  closed  by  any  pressure  in  the  supply  tank  as  long  as  it  is 
greater  than  the  pressure  in  the  test  section.  The  total  area  holding  the  main  valve  closed  is 
determined  by  the  two  o-rings  on  the  valve  which  create  an  area  of  =  77  in^.  While  the  piston 
which  moves  the  valve  has  an  area  «  40.6  in^.  Thus  it  takes  approximately  twice  the  supply  tank 
to  test  section  pressure  difference  to  make  the  main  valve  open*.  This  piston  is  moved  by  applying 
pressure  to  either  the  opening  or  closing  sides  while  having  the  opposite  side  vented  to 
atmosphere.  The  pressures  in  each  chamber  of  the  piston  housing  can  be  monitored  from  the 
outside  through  the  two  pressure  instrumentation  ports.  There  are  connections  for  five  needle 
valves  (although  they  do  not  have  to  be  used)  which  control  the  flow  going  in  and  out  of  each 
chamber.  There  are  two  standard  Whitey  3-way  ball  valves  attached  to  special  fast  acting  (30  ms) 
Calspan  manufactured  actuators  (PI  and  P2)  which  control  the  gas  flow  to  the  piston.  The  actuator 
control  component  shown  in  figure  4  controls  these  valves. 

Basically  the  two  reservoirs  are  filled  the  way  Belcan  intended  them  to  be.  Regulators  PCV 
107  and  PCV  109  (see  Belcan  PI&D)  are  used  to  set  the  pressures  which  range  between  4(X)-600 
psi.  PI  and  P2  are  set  such  that  the  piston  chambers  are  connected  to  the  vent  (in  other  words,  the 
gas  supply  is  isolated).  Then  EV  152  and  EV  151  are  opened  which  in  turn  open  PV  1 14  and  PV 
101,  allowing  the  two  reservoirs  to  be  filled.  At  any  point  in  time,  the  manual  valves  could  be 


*  However,  when  the  main  valve  is  closed  there  is  no  AP  acting  on  the  main  valve,  so  any  AP  across  the  piston 
should  make  the  main  valve  move  (accounting  for  friction,  of  course). 
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opened  to  release  the  gas  in  the  cylinders.  Once  the  cylinders  are  filled,  valves  EV  152  and  EV  151 
are  closed,  which  close  PV  1 14  and  PV  101. 

The  main  valve  is  opened  by  turning  PI  so  that  the  opening  reservoir  is  connected  to  piston 
chamber  1  which  forces  the  piston  and  main  valve  open.  The  main  valve  is  closed  by  turning  PI 
such  that  the  piston  chamber  1  is  connected  to  vent  and  P2  such  that  the  closing  reservoir  is 
connected  to  piston  chamber  2. 

This  component  has  several  different  features.  First,  the  main  valve  activation  component 
can  be  run  without  any  gas  in  the  piston  supply  which  allows  the  system  to  be  checked  out  (even  if 
the  supply  tank  is  pressurized)  before  a  run  without  having  to  open  the  main  valve.  Secondly,  to 
fire  the  main  valve  requires  that  both  the  piston  supply  and  actuator  components  be  armed.  Either 
armed  (and  fired)  independently  will  not  make  the  valve  move.  Finally,  to  make  the  entire  main 
valve  system  fail-safe  requires  only  that  P2  stay  in  its  chamber  2  to  close  reservoir  mode  and  that 
PI  be  in  a  mode  which  connects  chamber  1  to  the  vent. 

There  are  two  types  of  valves.  Valves  EV6022,  EV603  and  EV603’  are  3-way  fast  -acting 
Marrota  valves.  Valves  EV603  and  603’  are  operated  together  (i.e.  there  are  no  independent 
controls,  hence  their  names).  All  the  electric  valves  are  AC  actuated  Whitey  ball  valves.  EV  601 
and  605  are  on-off  valves  while  EV  604  and  606  are  three  way  valves.  There  is  a  needle  valve 
(NV607)  which  meters  the  flow  into  the  actuator  system  and  a  regulator  which  sets  the  maximum 
pressure.  Each  position  on  the  Whitey  valves  has  a  terminal.  When  power  is  applied  to  the 
terminal,  the  valve  rotates  to  that  position,  stops  and  turns  off  the  power.  To  move  the  valve  to  the 
next  position  requires  that  power  be  applied  to  the  appropriate  terminal.  This  is  beneficial  since  1) 
once  the  valve  is  in  the  proper  position  no  current  is  drawn,  reducing  the  E-M  noise  in  the 
environment  and  2)  if  there  is  a  power  failure  the  valves  stay  in  their  last  state.  The  key  valves 
which  move  PI  and  P2  are  the  Marotta’s.  The  system  is  armed  by  activating  valves  3  and  3’.  This 
blocks  the  reservoir  and  connects  Plb  and  P2a  to  atmosphere.  The  test  starts  when  EV602  is 
activated,  forcing  PI  to  change  position  and  releasing  gas  from  the  open  reservoir  into  chamber  1 
(see  figure  3).  The  test  terminates  when  the  main  valve  is  closed  and  is  accomplished  by 
deactivating  EV  602,  603  and  603’  (which  happens  much  faster  than  activation).  This  basically 
causes  PI  and  P2  to  change  positions.  As  an  extra  safety  precaution,  the  power  for  EV602  comes 
from  EV603  such  that  there  is  activation  power  when  EV603  is  energized.  Thus  if  one  were  to 
make  a  mistake  and  fire  EV602  without  any  gas  in  the  activation  reservoir,  or  without  the  intention 

^  The  numbering  system  has  changed.  All  other  PI&D  valve  references  on  ATARR  are  referenced  to  the  original 
Belcan  nomenclature  where  every  valve,  flow  control  device  was  labeled  according  to  the  following  system 
“abcxyy”  where  abc  refers  to  the  type  of  flow  control  device.  EV  is  electric  valve,  PSV  is  pressure  safety  valve, 
etc.  X  refers  to  the  PI&D  sheet  number  and  yy  refers  to  the  actual  number.  When  the  main  valve  was  undergoing 
initial  testing,  the  valves  were  simply  numbered  1,2,3,  etc.  which  correspond  to  the  present  last  two  digits  of  the 
existing  numbering  system.  Thus  older  editions  will  refer  to  these  valves  simply  by  their  number  with  no  other 
references  noted. 
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of  closing  the  main  valve,  it  could  not  be  done.  One  first  has  to  arm  EV603  and  EV603’.  Once 
this  has  been  accomplished,  any  power  failures  or  problems  automatically  deactivates  all  valves 
which  forces  gas  into  chamber  2,  closing  the  main  valve  if  it  is  open,  or  holding  it  close  if  it  has 
not  opened. 

Summary:  During  an  actual  test  (when  gas  if  flowing  through  a  turbine 
stage)  a  power  loss  immediately  shuts  the  main  valve.  Before  a  test,  but  after  the 
system  has  been  armed,  a  power  loss  ensures  that  main  valve  remains  closed. 

2.3.2  Isolation  Valve 

During  the  initial  check  out  of  this  system  it  became  clear  that  the  present  operation  of  the 
isolation  valve  was  unacceptable.  Therefore  the  existing  valve  will  be  redesigned  and  the  present 
isolation  valve  operating  procedure  will  be  changed.  This  system  is  not  required  for  the  vane-only 
tests,  but  will  be  needed  for  the  full  stage  testing.  An  update  to  this  document  will  be  provided 
after  final  check-out  of  the  modified  valve. 

2.3.3  Eddy  Brake 

The  present  operating  procedure  as  designed  by  Belcan  is  currently  being  checked-out.  It 
is  clear  that  some  addition  computer  (MCS)  checks  are  needed  to  verify  proper  brake  profiles. 

Final  testing  can  not  be  accomplished  until  the  entire  brake  system  is  installed  in  ATARR, 
sometime  in  November.  An  update  to  this  document  will  be  provided  after  final  check-out. 

The  final  source  of  problems  could  be  developed  during  a  run  and  would  occur  rapidly 
(with  a  time  constant  less  than  100  ms).  The  time  scale  is  so  small  that  human  intervention  can  not 
be  counted  on,  so  the  isolation  valve  is  designed  to  shut  down  the  test  in  the  event  of  either  of  the 
following:  1)  the  main  valve  failed  to  close  at  the  appropriate  time  or  2)  the  eddy  brake  failed  to 
turn  on  or  failed  during  operation.  In  both  cases,  the  tachometer  mounted  on  the  shaft  would  sense 
an  overspeed  condition  and  close  the  isolation  valve  quickly  so  as  to  prevent  disk  rupture. 

2.3.4  Emergency  Shut-Down  Procedure 

The  emergency  shut-down  procedure  is  completely  dependent  on  the  final  configurations  of 
the  isolation  valve  and  the  eddy-brake.  As  noted  above,  the  isolation  valve  is  currently  being 
redesigned  and  the  eddy  brake  is  not  yet  fully  installed.  For  the  purposes  of  the  immediate 
demonstration  experiments  (non-rotating,  vane  only  there  is  no  emergency  situation.  This  section 
will  added  just  prior  to  full-stage  demonstration  experiments. 

2 . 4  General  Operation 

2.4.1  Non-Rotating  Experiments 

It  should  be  clear  at  this  point  that  there  are  relatively  few  operating  dangers  associated  with 
running  the  facility  in  this  configuration  since  there  are  no  rotating  components.  Thus  if  the  main 
valve  were  to  open  unexpectedly,  all  that  would  happen  is  that  gas  would  blow  through  the  vane 
row  before  one  wanted  to  do  so.  Dangers  in  this  mode  of  operation  occur  from  operator  blunders 
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such  as  not  insuring  that  all  the  test  section  pieces  are  bolted  together  properly,  by  forgetting  to 
secure  the  housing  ports,  or  by  working  internal  on  the  test  section  when  the  supply  tank  is 
pressurized.  The  probability  of  something  like  this  happening  are  greatly  reduced  by  using 
common  sense  and  by  making  a  pretest  walk-around  checklist.  The  major  problems  are  likely  to 
come  from  the  process  control  of  the  facility  (i.e  evacuating  and  filling  the  tanks).  Specific  actions 
to  be  taken  in  case  of  a  problem  are  outlined  in  section  HI. 

2.4.2  Rotating  Experiments 

This  section  will  be  added  when  the  final  configuration  becomes  apparent,  especially  with 
regard  to  the  isolation  valve  and  eddy  brake  configuration. 
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3.  Specific  Hazard  Procedures 

This  section  discusses  specific  problems  which  may  arise  in  the  ATARR.  They  are 
grouped  by  major  activity  since  a  wide  variety  of  testing  conditions  could  cause  each  problem.  The 
specific  actions  are  outlined  here  with  the  assumption  that  the  operator  will  work  backwards 
towards  isolating  and  rectifying  the  problem. 

3.1  Major  N2  Leak 

The  ATARR  facility  is  equipped  with  low  oxygen  sensors  which  (as  mentioned  in  section 
n)  force  the  main  laboratory  doors  wide  open  if  there  is  a  significant  leak  and  turn  on  the  fire  alarm 
which  can  only  be  reset  by  the  fire  department.  If  this  alarm  goes  off  when  the  tanks  are  being 
filled,  the  procedure  should  be: 

1)  Isolate  all  sections  of  the  facility  (i.e.  stop  filling  tanks,  stop  evacuating  tanks,  etc.) 

This  can  be  done  by: 

a)  in  the  MCS  stopping  all  processes  you  are  engaged  in  by  either  telling  it  to  stop 
or  by  exiting  the  menu 

b)  pushing  the  big  power  shut-off  switch  on  the  control  panel 

2)  Leave  the  building 

3)  Turn-off  the  tube  tmck  both  at  the  truck  and  at  the  manual  valve  next  to  the  laboratory 
big  door. 

Having  done  the  above,  no  more  gas  can  enter  J-Bay  and  only  the  gas  already  in  the  section  which 
is  leaking  can  continue  to  leak  out.  Once  the  fire  department  has  come  and  reset  the  alarm,  try  to 
isolate  and  determine  which  section  of  the  facility  is  leaking. 

Realistically,  this  type  of  situation  has  only  two  sources.  One  comes  from  leaking  a  small 
amount  of  nitrogen  constantly  over  a  long  period  of  time.  The  alarm  was  once  set  off  by  blowing 
150  psi  nitrogen  through  the  main  valve  to  get  rid  of  the  metal  chips.  After  several  hours  sufficient 
nitrogen  had  accumulated  in  the  laboratory  to  set  off  the  alarm.  The  situation  could  have  easily 
been  avoided  by  simply  opening  the  laboratory  doors  to  allow  a  breeze  to  blow  through  the  facility. 
The  second  source  is  if  a  leak  develops  while  one  is  filling  the  supply  tank.  It  is  difficult  to 
envision  this  happening  unless  the  operator  was  filling  from  the  control  room  and  no  one  was  in  J- 
bay  to  hear  the  leak.  There  is  very  little  problem  hearing  even  small  leaks  in  the  system.  Thus  it 
makes  some  sense,  especially  during  the  initial  tests  of  any  matrix  to  do  the  filling  from  the 
laboratory  floor. 

3.2  Fire 

In  general,  the  response  is  the  same  as  for  a  major  N2  leak.  The  intent  is  to  isolate  the 
facility  and  leave  the  building.  There  is  actually  not  much  in  the  laboratory  area  that  can  bum,  so 
the  largest  probability  of  a  fire  comes  from  either  cleaning  solvents  or  electrical  problems.  If  one 


11 


knows  or  suspects  that  the  source  of  the  fire  is  electrical,  then  the  electrical  shut-down  procedure 
should  be  followed. 

3.3  Minor  N2  Leak 

More  likely  one  will  suffer  small  leaks  where  the  pressure  (or  vacuum)  in  a  section  of  the 
facility  can  not  be  held  constant.  This  only  becomes  a  safety  problem  if  the  oxygen  sensors  go  off. 
Most  often  the  individual  leaks  would  be  isolated  long  before  there  would  be  a  safety  concern. 

3.4  Liquid  CO2  Filling 

Probably  the  most  hazardous  routine  duty  will  be  working  with  the  liquid  CO2  dewers  due 
to  the  low  temperature.  Procedures  and  equipment  for  all  tasks  relating  to  these  dewers  are 
covered  extensively  in  the  information  package  from  the  manufacture,  which  is  included  as  an 
appendix  to  this  report. 

3.5  Tank  Entry 

Entering  the  supply  tank  at  any  point  in  time  when  the  main  valve  is  in  place  should  be 
considered  a  potential  hazardous  situation  (especially  when  one  is  entering  immediately  after 
testing).  The  recommended  procedure  is  too  “change  out”  the  gas  in  the  supply  tank  by  evacuating 
the  tank  and  then  venting  to  atmosphere.  This  works  quite  well,  especially  if  the  vacuum  pump 
filters  are  working  (so  that  residual  vacuum  oil  vapor  is  not  blown  back  into  the  supply  tank).  An 
oxygen  monitor  should  then  be  inserted  into  the  tank  to  check  for  oxygen  levels  before  a  person 
enters  the  tank.  Upon  entering  the  tank  someone  should  be  on  the  outside  ready  to  call  for  help  in 
case  there  is  an  emergency. 

General  procedures: 

1)  Change  gas  in  tank  by  evacuating  and  then  venting  to  atmosphere 

2)  Check  oxygen  level  with  monitor 

3)  Have  a  spotter 

4)  Enter  tank 

3.6  Vacuum  System 

The  vacuum  pump  system  consist  of  three  parts  (as  mentioned  in  section  H)  the  main 
pump,  the  filter  and  the  Roots  blower.  The  system  can  be  damaged  and  thus  will  not  perform 
correctly  if: 

1)  The  filters  are  cracked  or  not  installed  properly,  which  is  indicated  by  excess  smoke. 
When  the  vacuum  pump  and  filters  are  working  properly  there  should  be  very  little  smoke  coming 
out  of  the  vents  above  the  side  big  door. 

2)  The  cooling  water  is  not  turned  on.  The  best  check  for  this  is  to  shine  a  flashlight 
through  the  sight-glass  from  the  back.  If  the  cooling  water  is  on,  the  flapper  valve  will  be  open 
and  in  a  more  or  less  horizontal  position. 
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3)  If  there  is  too  much  or  too  little  oil  in  the  system.  There  is  a  sight  glass  on  the  side  of 
the  pump.  Manufactures  instructions  should  be  followed. 

4)  Over-pressurization  of  the  pump  or  blower  occurs. 

This  last  condition  is  the  most  likely  of  the  four  listed  above,  and  its  occurrence  shortens  the  life 
expectancy  of  vacuum  pumps.  The  vacuum  pump  itself  can  sustain  only  about  1  to  2  psi  above 
atmosphere  (these  data  are  in  the  stokes  pump  manual).  However  the  blower  is  even  more 
sensitive  and  can  not  sustain  a  large  pressure  differential.  It  is  designed  to  be  used  as  a  booster  to 
aid  in  lowering  the  pressure  to  the  one  torr  range.  The  controls  are  set  up  so  that  the  blower  can 
either  come  on  automatically  when  the  pressure  reaches  a  certain  point  (about  20  torr),  or  it  can  be 
permanently  tumed-off.  The  blower  becomes  damaged  if  in  the  process  of  evacuating  one  section 
of  the  facility  with  the  blower  on,  someone  inadvertently  opens  another  section  of  the  facility  (at 
high  pressure)  to  be  evacuated.  In  this  scenario  the  blower  sees  about  1  atmosphere,  creating  a 
large  strain  on  the  system.  The  best  way  to  avoid  this  problem  is  to  keep  the  blower  off  until  all 
sections  of  the  facility  are  connected  together  and  being  pumped  down  together.  Then  one  can  turn 
the  blower  to  automatic. 

In  general,  the  MCS  prevents  one  from  inadvertently  over-pressurizing  the  vacuum  pump 
by  verifying  that  pressures  in  all  the  relevant  piping  are  within  limits  when  one  requests  to  pump 
down  any  section  of  the  facility.  This  of  course  is  tme  only  of  the  main  control  menus  and  is  not 
tme  of  the  exercise  valve  menu,  which  has  no  logic  associated  with  it.  All  of  the  logical  checks 
done  by  the  MCS  are  listed  in  the  MCS  software  manual  (release  3). 

Thus  the  checklist  for  operating  the  vacuum  pump  is  simply: 

1)  Turn  on  and  verify  cooling  water  is  on 

2)  Verify  oil  level  is  correct 

3)  Set  blower  to  off 

4)  Turn  on  pump 

It  is  important  to  note  that  the  vacuum  pump  can  be  turned  off  from  the  control  panel 
upstairs.  The  vacuum  pump  button  has  the  effect  of  disrupting  the  power  to  the  vacuum  system. 
However  to  restart  the  pump  requires  direct  control  at  the  vacuum  pump.  It  was  designed  so  that 
the  vacuum  pump  could  be  shut  down  immediately  before  the  test  without  having  to  go  down  to 
the  laboratory  area. 

3.7  Test  Time  Failures 

There  are  basically  three  types  of  failures  that  can  occur  during  testing  (i.e.  the  time  from 
where  one  begins  to  fill  the  tanks  to  the  time  at  which  they  are  vented).  The  first  two:  power  and 
pressure  failures,  basically  cause  the  system  to  become  isolated.  This  is  desirable  if  a  problem 
arises,  so  the  system  has  already  gone  to  its  fail-safe  position  and  what  remains  is  to  find  out  why 


13 


the  problem  occurred.  These  are  generally  the  types  of  failures  that  occur  over  several  hours 
leading  up  to  the  turbine  test. 

During  a  turbine  test  (which  lasts  about  5  seconds),  there  is  only  one  real  concern:  that  the 
rotor  speeds  exceed  its  safety  limits.  As  mentioned  earlier,  this  can  occur  due  to  an  eddy  brake 
failure  or  a  main  valve  failure.  The  isolation  valve  is  designed  to  sense  this  condition, 
independently  of  the  MCS,  and  to  close  within  100  ms.  There  is  nothing  the  operator  can  do  in  a 
100  ms  interval  to  influence  this  event.  There  is,  however,  an  emergency  stop  button  on  the 
control  panel  which  cuts  off  power  to  everything.  This,  as  explained  earlier  during  the  isolation 
valve  discussion,  will  immediately  close  the  isolation  valve  if  there  is  any  pressure  across  it  (the 
only  dangerous  condition).  However,  by  the  time  the  operator  has  figured  out  what  is  happening, 
the  system  will  have  already  closed  the  isolation  valve. 

3.8  Electrical  Shut-Down  Procedure 

This  section  will  be  inserted  after  full  testing  of  the  eddy-brake  system  since  the  eddy-brake 
is  the  main  consumer  of  power  in  the  laboratory  area  during  a  test. 

3.9  Last  Resort  Procedure 

If  there  is  a  problem  not  understood  by  the  operator,  and  the  traditional  fail-isolate 
procedures  have  not  stabilized  the  situation,  then  the  following  are  general  guidelines. 

1)  If  the  power  gets  shut-off,  you  generally  will  not  be  able  to  use  the  MCS  to  help 
diagnose  the  situation.  While  there  are  manual  gauges  on  every  tank,  reading  them  requires 
someone  to  be  on  the  laboratory  floor,  which  should  be  done  with  great  caution  under  these 
conditions. 

2)  When  power  is  available  but  the  operator  does  not  understand  what  is  going  on,  reduce 
the  energy  levels  (that  is  all  sources),  turn  off  gas  (everywhere,  at  mbe  truck,  manual  valves,  etc), 
vent  tanks  and  turn  off  extraneous  power  sources.  However  to  vent  the  system  requires  the  MCS. 
This  can  be  done  either  through  the  vent  menu  or  through  the  exercise  valve  menu.  The  vent  menu 
will  use  pressure  transducers  to  check  to  see  if  it  has  completely  vented  (introducing  the  possibility 
that  there  may  be  transducer  error),  while  the  exercise  valve  menu  will  keep  the  vents  open  until  the 
user  closes  them. 
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4 .  Facility  Diagrams 

In  this  section  there  are  four  sets  of  schematics  dealing  with:  the  general  facility  PI&D's, 
the  general  nitrogen  flow  schematic,  the  main  valve  actuator  operation  schematics,  and  a  simplified 
power  schematic. 

General  PI&D's  (pgs.  16  -  21) 

These  are  copies  of  the  original  Belcan  drawings.  The  last  page  is  an  additional  one 
furnished  by  Calspan  which  covers  the  main  valve  activation  system. 

Simplifled  Nitrogen  Flow  and  Vacuum  System  (pgs.  22  -  23) 

This  diagram  shows  the  main  plumbing  of  the  facility.  It  can  be  used  in  conjunction  with 
the  MCS  logic  to  see  how  the  MCS  controls  the  various  facility  operations. 

Main  Valve  Schematics  (pgs.  24  -  35) 

These  include  the  simplified  schematics  of  both  the  main  valve  piston  gas  supply  (figure  3) 
and  the  main  valve  activation  control  (figure  4).  In  addition  the  steps  used  to  control  the  activation 
system  are  also  described.  There  is  a  great  deal  of  information  in  these  schematics. 

First,  figure  3  shows  the  main  valve  piston  gas  supply  from  valves  PVlOl  and  PVl  14 
through  the  system.  These  drawings  include  the  pressure  transmitters  used  for  the  MCS  but  not 
those  which  are  used  for  instramentation  purposes  (which  are  not  permanent).  Figure  4  shows  a 
piping  schematic  of  the  actuator  system.  In  addition  all  three  way  valves  have  their  connections 
labeled  with  arrows.  For  the  Whitey  valves  (EV604  and  EV606)  there  is  no  default  state,  while  the 
Marotta  valves  (EV602,  EV603,  and  EV603')  all  have  default  states  as  labeled.  In  this  drawing  the 
schematics  of  PI  and  P2  show  the  internal  configuration  of  the  spindle.  Using  this  information  as 
a  guide,  the  activation  steps  show  slightly  different  information.  In  these  drawings  each  valve 
position  (as  described  on  the  right-side  of  the  page)  is  shown  in  the  piping  diagrams,  thus  showing 
how  the  different  pieces  are  connected  together.  At  the  bottom  of  the  page  the  piston  gas  flow 
paths  are  shown  by  the  dark  fill  lines.  Thus  in  the  neutral  state,  both  chambers  of  the  piston  are 
connected  to  vent.  These  dark  lines  show  how  the  piston  gas  propagates  through  the  main  valve 
(shown  in  figure  3).  An  example  is  shown  in  step  2  where  EV603  and  EV603’  are  activated  and 
EV601  is  opened,  filling  the  actuation  reservoir  (note:  to  conserve  space,  only  the  last  digits  are 
used  to  indicate  the  valve  numbers  in  the  drawing).  Also  note  that  in  the  drawing  valve  EV603  and 
EV603'  have  changed  position  from  the  neutral  step  to  Step  1.  The  lighter  fill  lines  show  the 
leakage  path  that  exists  when  the  actuators  PI  and  P2  change  position.  The  bottom  of  each  page 
describes  the  action  taking  place. 

Simplified  Electrical  System  (pg.  36  -  37) 

This  drawing  needs  to  be  added  by  the  ATARR  facility  to  reflect  changes  made  in  the 
Eddy-Brake  system. 
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General  PI&D's 
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SUPPLY  Tank 
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Simplified  Nitrogen  Flow  and  Vacuum  System 
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Main  Valve  Schematics 
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Figure  3  Simplified  Schematic  of  Main  Valve  Piston  Gas  Supply 
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Valve  2  is  activated 
Test  Begins 


33 


Step  6a:  After  Test.  Start  P2  Reset  Process 
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Resevoir 


Simplified  Electrical  System 


Drawing  to  be  added  by  ATARR  Faclility 
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Drawing  to  be  added  by  ATARR  Faclility 
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5 .  Checklists 

This  section  contains  some  of  the  assembly  checklists.  Others  such  as  the  supply  tank 
heating  system,  the  agitator  fan  and  cooling  pump  system  should  be  added  once  these  systems 
have  been  checked  out.  These  could  then  be  combined  together  to  make  a  complete  test  checklist 
specific  to  the  test  matrix  being  used. 

Isolation  Valve  (pgs.  39  -  40  ) 

This  covers  both  initial  testing  (by  itself)  and  verification  of  operation  before  a  turbine  test. 
Main  Valve  Activation  (pgs.  41  -  44) 

This  covers  both  dry  testing  (with  no  piston  supply  gas),  manual  firing,  the  automatic 
firing  of  the  system,  and  the  procedures  for  placing  the  main  valve  into  a  total  "safe"  configuration. 
Extensive  use  of  the  main  valve  activation  operation  sheets  (in  Appendix  II)  are  used  as  an  aid. 
Initial  Evacuation  (pg.  45) 

This  covers  inspection,  vacuum  pump  start-up,  and  proper  operation  verification. 

Supply  Tank  Charging  (pg.  46) 

This  covers  inspection,  and  valve  placement  for  charging  the  supply  tank. 

Eddy  Brake  (pg.  47) 

This  covers  initial  testing,  inspection  and  set-up  for  final  turbine  testing 
Test  Checklist  Non-Rotating  Experiments  (pg.48) 

This  is  an  example  of  how  the  previous  checklists  could  be  combined  into  a  master 
checklist  for  a  non-rotating,  nitrogen  only,  experiment. 
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5.1  Isolation  Valve  Checklist 
Notes: 

This  is  the  present  procedure.  The  redesign  of  the  isolation  valve  will  undoubtedly  change 

this. 

Assumptions: 

1)  Isolation  valve  has  been  assembled  and  the  choice  area  set  correctly 

2)  Power  to  MCS  and  Genius  Panels  is  on 

3)  The  closing  pistons  and  the  tumbuckles  are  in  the  proper  position 

4)  Instrument  nitrogen  reservoir  is  filled  and  the  tube  truck  is  on 
Procedures: 

Initial  Inspection 

1 )  Verify  power  connected  to  EV 1 48  and  EV 1 32 

2)  Check  for  all  plumbing  connections:  nitrogen  in,  nothing  blocks  vents 

3)  Determine  initial  valve  position  (open  or  closed) 

4)  Verify  isolation  valve  housing  is  constrained  from  moving  when  the  valve  is  moved 

5)  Close  manual  valve  next  to  regulator  PCV  130. 

6)  Verify  access  ports  are  bolted  on 
Dry  Testing 

1)  Close  manual  valve  next  to  regulator  PCV  130. 

2)  Verify  pressure  in  supply  line  is  zero  (PI  131) 

3)  Connect  power  to  EV  148  and  EV  1 32 

4)  Activate  and  deactivate  EVI32.  Verify  that  EV132  changes  position  (can  be  done  by 
listening  to  the  valve  click,  it  is  loud) 

5)  Activate  and  deactivate  EV148  (same  as  step  4) 

Initial  Valve  Motion  tno  AP  across  valve") 

1)  Open  manual  valve  next  to  PCV  130 

2)  Set  PCV  130  to  lOpsi 

3)  Open  isolation  valve  (activate  EV148),  verify  isolation  valve  opened 

4)  Activate  EV132  (nothing  should  happen) 

5)  Close  isolation  valve  (deactivate  EV148),  verify  full  valve  closure.  This  must  be  done 
visually,  a  loud  bang  just  means  the  valve  has  seated  against  something,  it  may  not  be  closed. 
Pre-test  Preparation 

1)  Deactivate  EV  132 

2)  Set  PCV  1 30  to  lOpsi 

3)  Activate  EV148  (verify  isolation  valve  opened) 

4)  Set  PCV  130  to  1.15  Pu  (where  Pu  is  the  upstream  pressure) 
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Note:  These  last  two  steps  open  the  isolation  valve  and  then  increase  the 
pressure  to  hold  it  open  under  the  expected  supply  tank  pressure  load.  If  one 
were  to  increase  the  pressure  on  PCV  130  first,  then  activate  EV148,  one  risks 
opening  the  isolation  valve  so  hard  that  it  breaks  the  stops. 

Setting  for  Safe-Close  Position 

1)  SetPCVlSOto  lOpsi 

2)  Deactivate  EV 148 

3)  Activate  EV132,  verify  visually  isolation  valve  is  closed 

Note:  This  configuration  will  remain  closed  as  long  as  there  is  a  positive 
pressure  difference  (going  from  test  section  to  dump  tank)  across  the  isolation 
valve.  Even  if  the  power  to  EV132  were  to  fail  (and  thus  it  deactivates),  this 
pressure  difference  holds  the  valve  closed.  If  there  is  negative  pressure  across 
the  valve,  then  the  system  can  not  be  considered  safe. 
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5.2  Main  Valve  Activation  Checklist 


Notes:  Refer  to  accompanying  activation  drawings  in  section  IV 
Assumptions: 

1)  Two  nitrogen  bottles  are  connected  to  fill  system 

2)  Power  to  MCS  and  Genius  Panels  is  on 

3)  The  main  valve  is  initially  closed 

4)  That  the  main  valve  control  menu  on  the  MCS  is  used  to  control  the  operation 

5)  Instrument  nitrogen  reservoir  is  filled  and  the  tube  truck  is  on 
Procedures: 

Initial  Inspection  (Done  after  assembly  but  before  use) 

1)  Hoses  for  Pla,  Plb,  P2a,  P2b,  Reservoir  supplies,  and  vents  are  connected  properly 

2)  PI  and  P2  indicators  are  set  to  vent 

3)  Nitrogen  bottles  tuned  off 

4)  Regulators  PCV  109  and  PCV  107  off 

5)  Pressure  in  PI  108  =  0 

6)  Nitrogen  supply  to  EV152  and  EV151  is  open 

7)  EV152,EV151  closed 

8)  Manual  safety  valves  HCV  602,  603,  604  open 

9)  Verify  all  instrumentation  ports  are  either  closed  or  occupied 
Operation  of  activation  system  only 

1)  Verify  regulators  PCV  109  and  PCV  107  off 

2)  Verify  EV 1 52,  EV 1 5 1  closed 

3)  Verify  Manual  safety  valves  HCV  603,  604  open 

4)  Close  manual  safety  valve  HCV  602 

5)  Close  needle  valve  HCV  601 

6)  Verify  both  PI  and  P2  indicators  are  set  to  vent 

7)  Turn  on  nitrogen  bottles 

8)  Set  PCV  601  to  approximately  200  psi 

9)  Set  all  valves  to  state  shown  in  step  1 

( Valve  601  closed,  valve  602  deactive,  valves  603  and  603'  active,  valves  604, 606 
vented  and  valve  605  open)  [MCS  menu] 

10)  Open  HCV  601  5  turns 

1 1)  Follow  step  2  [MCS  menu] 

12)  Set  timer  for  main  valve  to  close  (usually  two  seconds)  [MCS  menu] 

1 3)  Start  test  [MCS  menu] 
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Note:  This  basically  starts  step  3  and  then  after  the  set  amount  of  time 
activates  step  4.  One  can  assure  proper  operation  by  checking  that  each  of  the 
actuator  indicators  (PI  and  P2)  have  changed  positions. 

14)  Follow  step  5  [MCS  menu] 

15)  Turn  valve  EV602  off 

Note:  The  valve  already  is  off,  since  EV603  and  603'  are  off.  However,  if 
these  were  to  be  reactivated  before  EV602  was  turned  off,  it  would  reactivate. 

This  is  purely  a  function  of  the  MCS  control  system  and  be  capable  of  being 
changed  so  that  it  happens  automatically. 

16)  Start  P2  reset  process.  Either: 

A)  Manually  move  P2  so  that  it  reads  vent 

B)  Follow  steps  6a,  6b,  and  7 

Manual  Firing  of  Valve  (this  means  not  letting  the  MCS  fire  the  system  with  the  rotor  spinning) 

1)  Verify  regulators  PCV  109  and  PCV  107  off 

2)  Verify  EV152,EV151  closed 

3)  Verify  Manual  safety  valves  HCV  602, 603, 604  closed 

4)  Verify  both  PI  and  P2  indicators  are  set  to  vent 

5)  Verify  EV601  closed 

6)  Verify  N2  instrument  reservoir  is  pressurized 

7)  Turn  on  nitrogen  bottles 

8)  Set  all  valves  to  state  shown  in  step  1 

( Valve  601  closed,  valve  602  deactive,  valves  603  and  603'  active,  valves  604,  606 
vented  and  valve  605  open)  [MCS  menu] 

9)  Set  PCV  601  to  approximately  200  psi 

10)  Set  regulator  PCV  109  to  closing  reservoir  pressure,  PCV  107  to  open  reservoir 
pressure 

11)  Open  EV151  until  open  reservoir  reaches  desired  pressure,  close  EV151 

12)  Open  EV152  until  closing  reservoir  reaches  desired  pressure,  close  EV152 

13)  Follow  step  2  [MCS  menu] 

14)  Set  timer  for  main  valve  to  close  (usually  two  seconds)  [MCS  menu] 

15)  Start  test  [MCS  menu] 

Note:  This  basically  starts  step  3  and  then  after  the  set  amount  of  time 
activates  step  4.  One  can  assure  proper  operation  by  checking  that  each  of  the 
actuator  indicators  (PI  and  P2)  have  changed  positions. 

16)  Follow  step  5  [MCS  menu] 

17)  Turn  valve  EV602  off 
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Note:  The  valve  already  is  off,  since  EV603  and  603'  are  off.  However,  if 
these  were  to  be  reactivated  before  EV602  was  turned  off,  it  would  reactivate. 

This  is  purely  a  function  of  the  MCS  control  system  and  be  capable  of  being 
changed  so  that  it  happens  automatically. 

18)  Start  P2  reset  process.  Verify  that  close  reservoir  pressure  is  0.  Either: 

A)  Manually  move  P2  so  that  it  reads  vent 

B)  Follow  steps  6a,  6b,  and  7 

Automatic  Firing  of  Valve  (this  means  letting  the  MCS  fire  the  system  with  the  rotor  spinning) 

Not  yet  configured 

Setting  the  main  valve  to  completely  safe  mode 

1)  Shut  of  N2  bottles 

2)  Open  manual  valves  in  following  order  HCV602,  604, 603 

Note:  The  order  is  important.  If  for  any  reason  there  was  pressure  in  the 
system,  this  allows  one  to  maintain  the  closed  position  of  the  valve  by  venting 
first  the  activation  reservoir  (there  should  be  nothing  in  it),  then  the  open 
reservoir  (which  may  have  some  residual  pressure),  and  then  finally  the  closing 
reservoir.  If  one  were  to  invert  the  order,  the  open  reservoir  pressure  could,  if 
one  accidentally  moved  PI  and  P2,  force  the  valve  open. 

3)  Verify  that  both  PI  and  P2  are  set  to  vent 

4)  If  any  of  the  following  indicate  pressure  PI  108,  PCV  109  or  PCV  107  then 

A)  Open  cross-over  ball  valve  between  FV154  and  FV 153 

B)  OpenEV152 

Note:  this  allows  any  extra  pressure  in  these  lines  to  pass  through  the 
close  reservoir  and  into  the  vents. 

C)  Close  ball  valve 

D)  Close  EV 152 

5)  If  PCV  601  has  pressure  on  it  open  EV601  until  pressure  is  vented,  then  close  EV601 

6)  Verify  all  pressure  indicates  on  system  read  zero 
Holding  Valve  Closed  (useful  for  seating  the  main  valve) 

1)  Verify  regulators  PCV  109  and  PCV  107  off 

2)  Verify  EV  1 52,  EV  1 5 1  closed 

3)  Verify  Manual  safety  valves  HCV  602, 603, 604  closed 

4)  Verify  both  PI  and  P2  indicators  are  set  to  vent 

5)  Verify  EV601  closed 

6)  Verify  N2  instrument  reservoir  is  pressurized 

7)  Turn  on  nitrogen  bottles 
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8)  Set  all  valves  to  state  shown  in  step  1 

( Valve  601  closed,  valve  602  deactive,  valves  603  and  603'  active,  valves  604, 606 
vented  and  valve  605  open)  [MCS  menu] 

9)  Set  PCV  601  to  approximately  200  psi 

10)  Set  regulator  PCV  109  to  200-400  psi 

11)  Open  EV152  until  closing  reservoir  reaches  desired  pressure 

12)  Follow  step  2  [MCS  menu] 

13)  Manually  shut-off  EV603  and  603' 

Note:  This  basically  starts  step  4  and' and  bypasses  step  5.  This  keeps  PI 
in  vent  mode  and  changes  P2  to  supply,  forcing  the  main  valve  closed.  EV152  is 
kept  open  so  that  nitrogen  is  constantly  supplied  to  the  piston  (which  leaks) 

14)  Close  EV601 

15)  Verify  main  valve  is  closed  (listening  for  leaks  or  checking  pressures) 

16)  Close  EV152 

18)  Start  P2  reset  process.  Verify  that  close  reservoir  pressure  is  0.  Either: 

A)  Manually  move  P2  so  that  it  reads  vent 

B)  Follow  steps  6a,  6b,  and  7 
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Initial  Evacuation  Checklist 


Assumptions: 

1)  That  the  facility  is  bolted  together 

2)  Power  to  MCS  and  Genius  Panels  is  on 

3)  Instrument  nitrogen  reservoir  is  filled  and  the  tube  truck  is  on 

Procedures: 

Initial  Inspection  IDone  before  turning  on  pump) 

1)  Verify  Cooling  water  to  test  section  is  hooked-up  or  that  manual  valve  to  test  section  is 
off 

2)  Verify  all  vacuum  lines  are  in  place 

3)  Verify  all  instmment  ports  or  inspection  ports  are  bolted  down 

4)  Vacuum  pump  has  oil 
Starting  Pump 

1)  Vacuum  manifold  is  shut  (EV317  is  closed) 

2)  Cooling  water  is  on,  flapper  valve  open 

3)  Blower  switch  off 

4)  Manual  instmment  valve  next  to  blower  either  off  or  isolated 

4)  MCS  on  and  in  pump  down  menu 

6)  Turn  on  pump 

7)  Verify  that  pump  is  working  (by  listening) 

Evacuation  of  sections 

1)  Verify  that  all  vents  to  section  are  closed  and  section  is  isolated 

2)  Open  connecting  valves  to  vacuum  system 

3)  Observe  outside  vents  (very  little  smoke  should  be  coming  out).  If  there  is  smoke, 
shut-down  system  and  check  filters 

4)  Once  the  final  valve  configuration  has  been  reached,  turn  blower  switch  to  automatic 
Shut-down  of  vacuum  pump 

1 )  Shut-of  pump 

2)  Vent  vacuum  side  of  pump  to  prevent  vacuum  oil  from  being  drawn  up  and  into  the 

piping 

3)  Turn-off  cooling  water 
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Supply  Tank  Charging  Checklist 


Assumptions: 

1)  That  the  facility  is  bolted  together,  man-way  closed 

2)  Power  to  MCS  and  Genius  Panels  is  on 

3)  That  the  supply  tank  has  been  evacuated 

4)  Main  valve  is  closed 

5)  Instrument  nitrogen  reservoir  is  filled  and  the  tube  tmck  is  on 

Procedures: 

Initial  Inspection  tPone  before  turning  on  vacuum  pump) 

1)  Verify  all  instrument  ports  are  in  place 
Charging  Supply  Tanks 

1)  Go  into  MCS  Charge  menu,  select  gas,  pressure  level 

2)  Verify  vents  are  closed 

3)  Verify  all  other  systems  are  isolated  (FV561  closed,  EV126  closed,  EV160  Closed) 

4)  Verify  manual  valve  to  supply  tank  is  open 

5)  Select  charge  on  menu 

Note:  As  the  rate  of  pressure  increase  in  the  supply  tank  starts  to  slow 
signiflcantly,  more  tubes  on  the  truck  will  need  to  be  opened.  Two  tubes 
represent  about  5  psi  increase  in  tank  pressure. 

6)  System  will  automatically  shut-off  when  desired  pressure  is  reached. 
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Eddy  Brake  Checklist 


Notes:  This  will  be  added  after  the  final  check-out  of  the  system 
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Test  Checklist  Non-Rotating  Experiments 

Assumptions: 

1)  That  the  facility  is  bolted  together,  man-way  closed 

2)  Power  to  MCS  and  Genius  Panels  is  on 

3)  That  all  systems  have  been  check-ed  out 
Procedures: 

Initial  Inspection  (Done  before  turning  on  vacuum  pump) 

1)  Walk  around  facility  check  for  tools  on  the  facility,  loose  wires,  loose  bolts,  trash,  etc. 

2)  Check  all  piping  connections 
Perform: 

3)  Vacuum  pump  inspection 

4)  Main  valve  inspection 

5)  Tank  charging  inspection 
Preparing  Facility  for  Testing 
Perform: 

1)  Vacuum  pump  start-up  procedure 

2)  Dump  tank  evacuation  procedure 

3)  Main  valve  closing  procedure 

4)  Supply  tank  evacuation  procedure 

Note:  for  best  results,  always  keep  a  positive  pressure  on  the  main  valve 
to  keep  it  from  opening 

5)  When  proper  vacuum  levels  are  reached  stop  supply  tank  evacuation  (but  continue 
dump  tank  and  test  section 

6)  Charge  supply  tank  with  nitrogen 

7)  Do  final  instrument  check 
Arming  Facility  and  performing  a  test 

1)  Isolate  and  turn  off  vacuum  pump 
Perform: 

2)  Arm  Isolation  valve 

3)  Arm  main  valve 

4)  Fire  main  valve 

5)  Verify  Main  valve  closed 

6)  Either  prepare  for  another  test  by 

A)  Venting  dump  tank  and  then  re-evacuating  dump  tank  and  test  section 

B)  Recharging  supply  tank 

7)  Or  move  to  safe  condition  by  performing  total  system  vent 


48 


Appendix  I  General  Situations  to  Avoid 

Throughout  the  initial  testing  of  the  ATARR,  several  facility  problems  which  were  not 
foreseen  (such  as  the  isolation  valve  and  main  valve  leaks)  have  occurred  which  have  lead  to 
several  "interesting"  yet  potentially  dangerous  testing  conditions.  These  conditions  are  not  part  of 
normal  ATARR  operations.  However,  it  is  felt  that  those  specific  testing  conditions  should  be 
discussed,  especially  the  dangers  inherent  in  them,  so  that  no  one  proceeds  with  the  idea  "that  since 
Calspan  did  one  test  this  way  it  must  be  safe."  Specifically  several  tests  were  done  with  the 
supply  tank  under  pressure  but  the  test  section  removed.  As  discussed  earlier,  to  have  the  main 
valve  open  in  this  situation  would  require  that  both  the  main  valve  piston  supply  be  charged,  the 
main  valve  activation  system  be  charge  and  the  manual  safety  valves  closed.  However,  having  the 
test  section  installed  (without  a  rotor)  means  that  even  if  the  main  valve  opened,  the  gas  could  only 
flow  into  the  dump  tank,  not  into  the  room. 

Thus  by  operating  with  the  test  section  removed,  Calspan  removed  one  of  the  multiple, 
redundant  safety  features.  While  there  was  no  safety  threat,  it  is  clear  that  pressurizing  the  supply 
tank  without  the  test  section  installed  should  not  be  a  routine  procedure. 

Similarly,  there  may  be  a  tendency  between  tests  to  take  off  an  inspection  plate  while  the 
supply  tank  is  still  pressurized  and  inspect  the  test-section.  For  obvious  reasons  this  is  a 
potentially  dangerous  situation  and  should  only  be  done  after  the  main  valve  has  been  place  into  its 
"safe"  mode;  and  then  only  if  it  necessary. 

There  were  also  times  when  the  isolation  valve  and  test  section  were  connected  to  the  dump 
tank  and  evacuated,  but  the  cooling  section  was  removed.  The  potential  in  this  case  is  to  be 
evacuated  into  the  test  section  if  something  went  wrong.  This  was  done  to  check  the  integrity  of 
the  isolation  valve.  This  type  of  operation  should  only  be  done  if  the  isolation  valve  has  been 
placed  in  its  "safe-close"  mode  and  if  there  are  no  other  ways  to  test  the  system. 

There  were  also  situations  where  both  the  isolation  valve  and  main  valve  were  tested  dry 
(i.e  with  no  pressure  difference  across  them),  while  people  watched  the  motion.  Clearly,  a  safe 
distance  should  be  maintained  to  avoid  any  potential  problems. 

In  summary  the  situations  to  avoid  are: 

1)  Pressurizing  the  facility  without  the  entire  test  section  installed 

2)  Working  directly  downstream  of  the  supply  tank  when  it  is  pressurized 

3)  Evacuating  the  facility  without  the  entire  test  section  installed 

4)  Working  on  the  facility  when  parts  of  it  are  under  vacuum 

That  does  not  mean  that  one  can  not  undertake  these  tasks,  rather  that  one  should  be  aware  of  the 
increased  risks. 


